Deserialization Vulnerability in LabOne Q Framework by Zurich Instruments

CVE-2026-7584

What is CVE-2026-7584?

The LabOne Q serialization framework contains a vulnerability in its deserialization mechanism, which allows an attacker to exploit arbitrary class-loading via unserialized data. Because the framework permits the import and instantiation of Python classes without adequate validation, a crafted serialized file could lead to arbitrary code execution. This risk arises particularly when malicious files are inadvertently loaded by users in collaboration environments or during technical support sessions.

References